Merge remote-tracking branch 'origin/dev' into sync-github-and-ci-fix

app/api/admin/vncdirectory/route.ts

@@ -0,0 +1,146 @@
+import { NextRequest, NextResponse } from 'next/server';
+import { requireAdminAuth, getClientIP } from '@/lib/admin/session';
+import { auditLog } from '@/lib/admin/audit';
+import { logger } from '@/lib/logger';
+import {
+  getVncDirectoryConfig,
+  saveVncDirectoryConfig,
+  DEFAULT_VNCDIRECTORY_CONFIG,
+  VNCDIRECTORY_SENSITIVE_KEYS,
+  type VncDirectoryConfig,
+} from '@/lib/admin/vncdirectory-config';
+
+const VALID_LDAP_TYPES = new Set(['openldap', 'ms-ad']);
+const KNOWN_KEYS = new Set(Object.keys(DEFAULT_VNCDIRECTORY_CONFIG));
+
+function maskConfigForClient(config: VncDirectoryConfig): Record<string, unknown> {
+  const result: Record<string, unknown> = {};
+  for (const [key, value] of Object.entries(config)) {
+    if (VNCDIRECTORY_SENSITIVE_KEYS.has(key)) {
+      result[key] = typeof value === 'string' && value.length > 0 ? '••••••' : '';
+    } else {
+      result[key] = value;
+    }
+  }
+  return result;
+}
+
+export async function GET(request: NextRequest) {
+  try {
+    const result = await requireAdminAuth(request);
+    if ('error' in result) return result.error;
+
+    const config = await getVncDirectoryConfig();
+    return NextResponse.json(maskConfigForClient(config), {
+      headers: { 'Cache-Control': 'no-store' },
+    });
+  } catch (error) {
+    logger.error('VNCdirectory config read error', {
+      error: error instanceof Error ? error.message : 'Unknown error',
+    });
+    return NextResponse.json({ error: 'Internal server error' }, { status: 500 });
+  }
+}
+
+export async function POST(request: NextRequest) {
+  try {
+    const authResult = await requireAdminAuth(request);
+    if ('error' in authResult) return authResult.error;
+
+    const ip = getClientIP(request);
+    const body = await request.json();
+
+    if (!body || typeof body !== 'object' || Array.isArray(body)) {
+      return NextResponse.json({ error: 'Request body must be an object' }, { status: 400 });
+    }
+
+    // Validate known keys only
+    const unknownKeys = Object.keys(body).filter((k) => !KNOWN_KEYS.has(k));
+    if (unknownKeys.length > 0) {
+      return NextResponse.json(
+        { error: `Unknown config keys: ${unknownKeys.join(', ')}` },
+        { status: 400 },
+      );
+    }
+
+    // Validate boolean fields
+    const boolFields = ['enabled', 'samlEnabled', 'ldapEnabled', 'tfaEnabled', 'oidcEnabled'];
+    for (const key of boolFields) {
+      if (key in body && typeof body[key] !== 'boolean') {
+        return NextResponse.json(
+          { error: `${key} must be a boolean` },
+          { status: 400 },
+        );
+      }
+    }
+
+    // Validate sessionTtl
+    if ('sessionTtl' in body) {
+      const ttl = Number(body.sessionTtl);
+      if (!Number.isFinite(ttl) || ttl < 0) {
+        return NextResponse.json(
+          { error: 'sessionTtl must be a non-negative number' },
+          { status: 400 },
+        );
+      }
+      body.sessionTtl = ttl;
+    }
+
+    // Validate ldapType
+    if ('ldapType' in body && !VALID_LDAP_TYPES.has(body.ldapType)) {
+      return NextResponse.json(
+        { error: `Invalid ldapType: ${body.ldapType}. Must be 'openldap' or 'ms-ad'.` },
+        { status: 400 },
+      );
+    }
+
+    // Validate federatedApps
+    if ('federatedApps' in body) {
+      if (!body.federatedApps || typeof body.federatedApps !== 'object' || Array.isArray(body.federatedApps)) {
+        return NextResponse.json(
+          { error: 'federatedApps must be an object mapping app names to URLs' },
+          { status: 400 },
+        );
+      }
+      for (const [appName, url] of Object.entries(body.federatedApps as Record<string, unknown>)) {
+        if (typeof url !== 'string') {
+          return NextResponse.json(
+            { error: `federatedApps.${appName} must be a string URL` },
+            { status: 400 },
+          );
+        }
+      }
+    }
+
+    // If apiKey or ldapBindPassword are "••••••", preserve existing value
+    const currentConfig = await getVncDirectoryConfig();
+    if (body.apiKey === '••••••') {
+      body.apiKey = currentConfig.apiKey;
+    }
+    if (body.ldapBindPassword === '••••••') {
+      body.ldapBindPassword = currentConfig.ldapBindPassword;
+    }
+
+    const changedKeys = Object.keys(body).filter((k) => {
+      const currentVal = currentConfig[k as keyof VncDirectoryConfig];
+      const newVal = body[k];
+      if (k === 'federatedApps') {
+        return JSON.stringify(currentVal) !== JSON.stringify(newVal);
+      }
+      return String(currentVal ?? '') !== String(newVal ?? '');
+    });
+
+    await saveVncDirectoryConfig(body as Partial<VncDirectoryConfig>);
+
+    if (changedKeys.length > 0) {
+      await auditLog('vncdirectory.update', { changedKeys }, ip);
+    }
+
+    return NextResponse.json({ ok: true });
+  } catch (error) {
+    logger.error('VNCdirectory config update error', {
+      error: error instanceof Error ? error.message : 'Unknown error',
+    });
+    return NextResponse.json({ error: 'Internal server error' }, { status: 500 });
+  }
+}

app/api/auth/sso/start/route.ts

@@ -10,6 +10,17 @@ import { getCookieOptions } from '@/lib/oauth/cookie-config';
 import { hasSessionSecret } from '@/lib/auth/session-secret';
 import { configManager } from '@/lib/admin/config-manager';
 
+// TODO(P2.13): Wire SAML IDP integration once VNCdirectory is configured.
+// When VNCdirectory is enabled and SAML is configured (see
+// lib/admin/vncdirectory-config.ts), the SSO start flow should:
+//   1. Check isVncDirectoryEnabled() — if false, fall through to existing OAuth flow.
+//   2. Read getVncDirectoryConfig() for samlIdpUrl, samlIssuer, samlSpCert.
+//   3. Build a SAML AuthnRequest and redirect to the IdP instead of OAuth.
+//   4. The /sso/complete handler should process the SAML Response assertion,
+//      validate the signature against the SP certificate, extract the subject,
+//      and create a session.
+// Reference: docs/admin/VNCDIRECTORY.md in the VNCmail+ plan (P2.13).
+
 const SSO_PENDING_COOKIE = 'sso_pending';
 const SSO_PENDING_MAX_AGE = 300; // 5 minutes
 

app/api/collabora/edit/route.ts

@@ -0,0 +1,32 @@
+import { NextRequest, NextResponse } from "next/server";
+import { getCollaboraEditUrl } from "@/lib/collabora/client";
+import { logger } from "@/lib/logger";
+
+export async function POST(request: NextRequest) {
+  try {
+    const body = await request.json();
+
+    if (!body.fileId || !body.fileName) {
+      return NextResponse.json(
+        { error: "Missing required fields: fileId, fileName" },
+        { status: 400 }
+      );
+    }
+
+    const url = await getCollaboraEditUrl(
+      String(body.fileId),
+      String(body.fileName)
+    );
+
+    return NextResponse.json({ url });
+  } catch (error) {
+    const message = error instanceof Error ? error.message : "Unknown error";
+    logger.error("Collabora edit URL failed", { error: message });
+
+    if (message.includes("not configured")) {
+      return NextResponse.json({ error: message }, { status: 503 });
+    }
+
+    return NextResponse.json({ error: message }, { status: 500 });
+  }
+}

app/api/resources/[id]/availability/route.ts

@@ -0,0 +1,31 @@
+import { NextRequest, NextResponse } from 'next/server';
+import { logger } from '@/lib/logger';
+import { getStalwartCredentials } from '@/lib/stalwart/credentials';
+import { checkAvailability } from '@/lib/resources/client';
+
+export async function GET(
+  request: NextRequest,
+  { params }: { params: Promise<{ id: string }> },
+) {
+  try {
+    const creds = await getStalwartCredentials(request);
+    if (!creds) {
+      return NextResponse.json({ error: 'Not authenticated' }, { status: 401 });
+    }
+
+    const { id } = await params;
+    const { searchParams } = new URL(request.url);
+    const start = searchParams.get('start');
+    const end = searchParams.get('end');
+
+    if (!start || !end) {
+      return NextResponse.json({ error: 'start and end query parameters are required' }, { status: 400 });
+    }
+
+    const result = await checkAvailability(id, start, end);
+    return NextResponse.json(result);
+  } catch (error) {
+    logger.error('Resource availability error', { error: error instanceof Error ? error.message : 'Unknown' });
+    return NextResponse.json({ error: 'Internal server error' }, { status: 500 });
+  }
+}

app/api/resources/[id]/book/[bookingId]/route.ts

@@ -0,0 +1,24 @@
+import { NextRequest, NextResponse } from 'next/server';
+import { logger } from '@/lib/logger';
+import { getStalwartCredentials } from '@/lib/stalwart/credentials';
+import { cancelBooking } from '@/lib/resources/client';
+
+export async function DELETE(
+  request: NextRequest,
+  { params }: { params: Promise<{ id: string; bookingId: string }> },
+) {
+  try {
+    const creds = await getStalwartCredentials(request);
+    if (!creds) {
+      return NextResponse.json({ error: 'Not authenticated' }, { status: 401 });
+    }
+
+    const { bookingId } = await params;
+    await cancelBooking(bookingId);
+
+    return NextResponse.json({ ok: true });
+  } catch (error) {
+    logger.error('Resource booking cancel error', { error: error instanceof Error ? error.message : 'Unknown' });
+    return NextResponse.json({ error: 'Internal server error' }, { status: 500 });
+  }
+}

app/api/resources/[id]/book/route.ts

@@ -0,0 +1,40 @@
+import { NextRequest, NextResponse } from 'next/server';
+import { logger } from '@/lib/logger';
+import { getStalwartCredentials } from '@/lib/stalwart/credentials';
+import { bookResource, checkAvailability, getResource } from '@/lib/resources/client';
+
+export async function POST(
+  request: NextRequest,
+  { params }: { params: Promise<{ id: string }> },
+) {
+  try {
+    const creds = await getStalwartCredentials(request);
+    if (!creds) {
+      return NextResponse.json({ error: 'Not authenticated' }, { status: 401 });
+    }
+
+    const { id } = await params;
+    const body = await request.json();
+    const { start, end, eventId } = body;
+
+    if (!start || !end) {
+      return NextResponse.json({ error: 'start and end are required' }, { status: 400 });
+    }
+
+    const resource = await getResource(id);
+    if (!resource) {
+      return NextResponse.json({ error: 'Resource not found' }, { status: 404 });
+    }
+
+    const { available, conflicts } = await checkAvailability(id, start, end);
+    if (!available) {
+      return NextResponse.json({ error: 'Resource is not available for the requested time', conflicts }, { status: 409 });
+    }
+
+    const booking = await bookResource(id, start, end, creds.username, eventId);
+    return NextResponse.json({ booking }, { status: 201 });
+  } catch (error) {
+    logger.error('Resource booking error', { error: error instanceof Error ? error.message : 'Unknown' });
+    return NextResponse.json({ error: 'Internal server error' }, { status: 500 });
+  }
+}

app/api/resources/[id]/route.ts

@@ -0,0 +1,27 @@
+import { NextRequest, NextResponse } from 'next/server';
+import { logger } from '@/lib/logger';
+import { getStalwartCredentials } from '@/lib/stalwart/credentials';
+import { getResource } from '@/lib/resources/client';
+
+export async function GET(
+  request: NextRequest,
+  { params }: { params: Promise<{ id: string }> },
+) {
+  try {
+    const creds = await getStalwartCredentials(request);
+    if (!creds) {
+      return NextResponse.json({ error: 'Not authenticated' }, { status: 401 });
+    }
+
+    const { id } = await params;
+    const resource = await getResource(id);
+    if (!resource) {
+      return NextResponse.json({ error: 'Resource not found' }, { status: 404 });
+    }
+
+    return NextResponse.json({ resource });
+  } catch (error) {
+    logger.error('Resource get error', { error: error instanceof Error ? error.message : 'Unknown' });
+    return NextResponse.json({ error: 'Internal server error' }, { status: 500 });
+  }
+}

app/api/resources/route.ts

@@ -0,0 +1,59 @@
+import { NextRequest, NextResponse } from 'next/server';
+import { logger } from '@/lib/logger';
+import { getStalwartCredentials } from '@/lib/stalwart/credentials';
+import { listResources, createResource, getBookingsForEvent } from '@/lib/resources/client';
+
+export async function GET(request: NextRequest) {
+  try {
+    const creds = await getStalwartCredentials(request);
+    if (!creds) {
+      return NextResponse.json({ error: 'Not authenticated' }, { status: 401 });
+    }
+
+    const { searchParams } = new URL(request.url);
+    const type = searchParams.get('type') || undefined;
+    const eventId = searchParams.get('eventId') || undefined;
+
+    if (eventId) {
+      const bookings = await getBookingsForEvent(eventId);
+      return NextResponse.json({ bookings });
+    }
+
+    const resources = await listResources(creds.username, type);
+    return NextResponse.json({ resources });
+  } catch (error) {
+    logger.error('Resources list error', { error: error instanceof Error ? error.message : 'Unknown' });
+    return NextResponse.json({ error: 'Internal server error' }, { status: 500 });
+  }
+}
+
+export async function POST(request: NextRequest) {
+  try {
+    const creds = await getStalwartCredentials(request);
+    if (!creds) {
+      return NextResponse.json({ error: 'Not authenticated' }, { status: 401 });
+    }
+
+    const body = await request.json();
+    const { name, type, location, capacity, description, contactEmail, metadata } = body;
+
+    if (!name || !type || !['room', 'vehicle', 'equipment', 'other'].includes(type)) {
+      return NextResponse.json({ error: 'Name and valid type are required' }, { status: 400 });
+    }
+
+    const resource = await createResource(creds.username, {
+      name,
+      type,
+      location,
+      capacity: capacity ? Number(capacity) : undefined,
+      description,
+      contactEmail,
+      metadata,
+    });
+
+    return NextResponse.json({ resource }, { status: 201 });
+  } catch (error) {
+    logger.error('Resource create error', { error: error instanceof Error ? error.message : 'Unknown' });
+    return NextResponse.json({ error: 'Internal server error' }, { status: 500 });
+  }
+}

app/api/sharing/route.ts

@@ -0,0 +1,361 @@
+import type { NextRequest } from "next/server";
+
+type JmapMethodCall = [string, Record<string, unknown>, string];
+
+async function jmapRequest(
+  serverUrl: string,
+  authHeader: string,
+  methodCalls: JmapMethodCall[],
+  using?: string[],
+) {
+  const sessionResp = await fetch(`${serverUrl}/.well-known/jmap`, {
+    headers: { Authorization: authHeader },
+  });
+  if (!sessionResp.ok) {
+    return { error: `Session fetch failed: ${sessionResp.status}` };
+  }
+  const session = await sessionResp.json();
+  const apiUrl = session.apiUrl;
+  if (!apiUrl) {
+    return { error: "No API URL in JMAP session" };
+  }
+
+  const body = {
+    using: using || [
+      "urn:ietf:params:jmap:core",
+      "urn:ietf:params:jmap:mail",
+      "urn:ietf:params:jmap:principals",
+    ],
+    methodCalls,
+  };
+
+  const resp = await fetch(apiUrl, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/json",
+      Authorization: authHeader,
+    },
+    body: JSON.stringify(body),
+  });
+
+  if (!resp.ok) {
+    return { error: `JMAP request failed: ${resp.status}` };
+  }
+
+  return await resp.json();
+}
+
+export async function GET(request: NextRequest) {
+  const { searchParams } = new URL(request.url);
+  const action = searchParams.get("action");
+  const serverUrl = request.headers.get("X-JMAP-Server-Url");
+  const authHeader = request.headers.get("Authorization");
+
+  if (!serverUrl || !authHeader) {
+    return Response.json(
+      { error: "Missing server URL or auth header" },
+      { status: 400 },
+    );
+  }
+
+  if (action !== "principals") {
+    return Response.json(
+      { error: "Invalid action" },
+      { status: 400 },
+    );
+  }
+
+  const result = await jmapRequest(serverUrl, authHeader, [
+    ["Principal/query", { accountId: "" }, "0"],
+    ["Principal/get", {
+      accountId: "",
+      "#ids": {
+        resultOf: "0",
+        name: "Principal/query",
+        path: "/ids",
+      },
+    }, "1"],
+  ]);
+
+  if ("error" in result) {
+    return Response.json(result, { status: 502 });
+  }
+
+  const getResp = (result as Record<string, unknown>).methodResponses as Array<[string, Record<string, unknown>, string]> | undefined;
+  const principals = getResp?.find((r) => r[0] === "Principal/get")?.[1]
+    ?.list ?? [];
+
+  return Response.json({ principals });
+}
+
+export async function POST(request: NextRequest) {
+  const serverUrl = request.headers.get("X-JMAP-Server-Url");
+  const authHeader = request.headers.get("Authorization");
+
+  if (!serverUrl || !authHeader) {
+    return Response.json(
+      { error: "Missing server URL or auth header" },
+      { status: 400 },
+    );
+  }
+
+  let body: Record<string, unknown>;
+  try {
+    body = await request.json();
+  } catch {
+    return Response.json({ error: "Invalid JSON body" }, { status: 400 });
+  }
+
+  const { kind, resourceId, principalId, role } = body;
+
+  if (!kind || !resourceId || !principalId) {
+    return Response.json(
+      { error: "Missing required fields: kind, resourceId, principalId" },
+      { status: 400 },
+    );
+  }
+
+  let method: string;
+  let shareProperty: string;
+
+  switch (kind) {
+    case "mailbox":
+      method = "Mailbox/set";
+      shareProperty = "shareWith";
+      break;
+    case "calendar":
+      method = "Calendar/set";
+      shareProperty = "shareWith";
+      break;
+    case "addressBook":
+      method = "AddressBook/set";
+      shareProperty = "shareWith";
+      break;
+    case "file":
+      method = "FileNode/set";
+      shareProperty = "shareWith";
+      break;
+    default:
+      return Response.json(
+        { error: `Invalid kind: ${kind}` },
+        { status: 400 },
+      );
+  }
+
+  const patchValue = role === null ? null : buildRights(kind as string, role as string);
+
+  const methodCalls: JmapMethodCall[] = [
+    [
+      method,
+      {
+        accountId: "",
+        update: {
+          [resourceId as string]: {
+            [`${shareProperty}/${principalId}`]: patchValue,
+          },
+        },
+      },
+      "0",
+    ],
+  ];
+
+  const result = await jmapRequest(
+    serverUrl,
+    authHeader,
+    methodCalls,
+  );
+
+  if ("error" in result) {
+    return Response.json(result, { status: 502 });
+  }
+
+  const responses = (result as Record<string, unknown>).methodResponses as Array<[string, Record<string, unknown>, string]> | undefined;
+  const setResult = responses?.[0]?.[1];
+
+  if (
+    setResult &&
+    typeof setResult === "object" &&
+    "notUpdated" in setResult &&
+    setResult.notUpdated &&
+    typeof setResult.notUpdated === "object" &&
+    (resourceId as string) in setResult.notUpdated
+  ) {
+    const err = (setResult.notUpdated as Record<string, Record<string, unknown>>)[resourceId as string];
+    return Response.json(
+      { error: err.description || "Failed to update share" },
+      { status: 400 },
+    );
+  }
+
+  return Response.json({ ok: true });
+}
+
+function buildRights(
+  kind: string,
+  role: string,
+): Record<string, boolean> | null {
+  if (role === null) return null;
+
+  switch (kind) {
+    case "mailbox":
+      return mailboxRights(role);
+    case "calendar":
+      return calendarRights(role);
+    case "addressBook":
+      return addressBookRights(role);
+    case "file":
+      return fileRights(role);
+    default:
+      return readRights();
+  }
+}
+
+function mailboxRights(role: string): Record<string, boolean> {
+  switch (role) {
+    case "read":
+      return {
+        mayReadItems: true,
+        mayAddItems: false,
+        mayRemoveItems: false,
+        maySetSeen: false,
+        maySetKeywords: false,
+        mayCreateChild: false,
+        mayRename: false,
+        mayDelete: false,
+        maySubmit: false,
+      };
+    case "readWrite":
+      return {
+        mayReadItems: true,
+        mayAddItems: true,
+        mayRemoveItems: false,
+        maySetSeen: true,
+        maySetKeywords: true,
+        mayCreateChild: false,
+        mayRename: false,
+        mayDelete: false,
+        maySubmit: true,
+      };
+    case "manager":
+      return {
+        mayReadItems: true,
+        mayAddItems: true,
+        mayRemoveItems: true,
+        maySetSeen: true,
+        maySetKeywords: true,
+        mayCreateChild: true,
+        mayRename: true,
+        mayDelete: true,
+        maySubmit: true,
+        mayShare: true,
+      };
+    default:
+      return mailboxRights("read");
+  }
+}
+
+function calendarRights(role: string): Record<string, boolean> {
+  switch (role) {
+    case "read":
+      return {
+        mayReadFreeBusy: true,
+        mayReadItems: true,
+        mayWriteAll: false,
+        mayWriteOwn: false,
+        mayUpdatePrivate: false,
+        mayRSVP: false,
+        mayShare: false,
+        mayDelete: false,
+      };
+    case "readWrite":
+      return {
+        mayReadFreeBusy: true,
+        mayReadItems: true,
+        mayWriteAll: true,
+        mayWriteOwn: true,
+        mayUpdatePrivate: true,
+        mayRSVP: true,
+        mayShare: false,
+        mayDelete: false,
+      };
+    case "manager":
+      return {
+        mayReadFreeBusy: true,
+        mayReadItems: true,
+        mayWriteAll: true,
+        mayWriteOwn: true,
+        mayUpdatePrivate: true,
+        mayRSVP: true,
+        mayShare: true,
+        mayDelete: true,
+      };
+    default:
+      return calendarRights("read");
+  }
+}
+
+function addressBookRights(role: string): Record<string, boolean> {
+  switch (role) {
+    case "read":
+      return {
+        mayRead: true,
+        mayWrite: false,
+        mayShare: false,
+        mayDelete: false,
+      };
+    case "readWrite":
+      return {
+        mayRead: true,
+        mayWrite: true,
+        mayShare: false,
+        mayDelete: false,
+      };
+    case "manager":
+      return {
+        mayRead: true,
+        mayWrite: true,
+        mayShare: true,
+        mayDelete: true,
+      };
+    default:
+      return addressBookRights("read");
+  }
+}
+
+function fileRights(role: string): Record<string, boolean> {
+  switch (role) {
+    case "read":
+      return {
+        mayRead: true,
+        mayAddChildren: false,
+        mayRename: false,
+        mayDelete: false,
+        mayModifyContent: false,
+        mayShare: false,
+      };
+    case "readWrite":
+      return {
+        mayRead: true,
+        mayAddChildren: true,
+        mayRename: true,
+        mayDelete: true,
+        mayModifyContent: true,
+        mayShare: false,
+      };
+    case "manager":
+      return {
+        mayRead: true,
+        mayAddChildren: true,
+        mayRename: true,
+        mayDelete: true,
+        mayModifyContent: true,
+        mayShare: true,
+      };
+    default:
+      return fileRights("read");
+  }
+}
+
+function readRights(): Record<string, boolean> {
+  return { mayRead: true };
+}

app/api/vnctalk/meeting/route.ts

@@ -0,0 +1,49 @@
+import { NextRequest, NextResponse } from "next/server";
+import { createVncMeeting } from "@/lib/vnctalk/client";
+import { logger } from "@/lib/logger";
+
+function getClientIP(request: NextRequest): string {
+  const forwarded = request.headers.get("x-forwarded-for");
+  if (forwarded) return forwarded.split(",")[0].trim();
+  return "127.0.0.1";
+}
+
+export async function POST(request: NextRequest) {
+  try {
+    const body = await request.json();
+
+    if (!body.name || !body.start || !body.end) {
+      return NextResponse.json(
+        { error: "Missing required fields: name, start, end" },
+        { status: 400 }
+      );
+    }
+
+    const invitees: string[] = Array.isArray(body.invitees) ? body.invitees : [];
+
+    const result = await createVncMeeting({
+      name: String(body.name),
+      start: String(body.start),
+      end: String(body.end),
+      invitees,
+      password: body.password ? String(body.password) : undefined,
+      description: body.description ? String(body.description) : undefined,
+    });
+
+    logger.info("VNCtalk meeting created", {
+      meetingId: result.meetingId,
+      ip: getClientIP(request),
+    });
+
+    return NextResponse.json(result, { status: 201 });
+  } catch (error) {
+    const message = error instanceof Error ? error.message : "Unknown error";
+    logger.error("VNCtalk meeting creation failed", { error: message });
+
+    if (message.includes("not configured")) {
+      return NextResponse.json({ error: message }, { status: 503 });
+    }
+
+    return NextResponse.json({ error: message }, { status: 500 });
+  }
+}